NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Go modules · #2514 by repository stars
Last release 7 days ago
29 Sep 2026
Ships fairly regularly
a new release about every 2 weeks
Some releases are documented
notes for 10 of 19 stable releases
Nothing withdrawn
no release was ever pulled
10 years old
243 releases · first in 2017
Nothing published for this version
Nothing published for this version
The dispatcher is gone! Well, mostly. We still have a shim for backward compatibility.
QUIC configuration field is gone from the Control Service's schema. It must be removed from toml files.router.bfd. This allows to configure BFD on all links by default. Subfields are the same as in the bfd field of links in the topology configuration. The defaults apply to links that do not have an explicit configuration for a given field. Previously, this was done by setting the environment variables SCION_EXPERIMENTAL_BFD_*. Those are now ignored.dispatched_ports. While transitioning away from the dispatcher, SCION applications on dispatcher-less hosts are expected to listen on a restricted port range. This must be set to the same value on updated hosts and on their updated border routers. The recommended value is dispatched_ports="31000 - 32767". This must be configured, there is no safe default.As usual, we've put quite a bit of effort in improving build reliability, burying dead code, simplifying, adding tests, fixing flakes, filling potholes, and complying with best practice and standards (including SCION published specs). Most notable in the latter category were:
We have also made a small improvement to Wireshark's SCION support: heuristic detection of SCION traffic is now supported. With the removal of the dispatcher and associated limited port range, this became nice-to-have.
We have updated a few of our dependencies. Most notably our minimum Go version, which is now 1.22.7. Also updated are:
Full Changelog: v0.11.0...v0.12.0
One column per quarter.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
The old public and bind fields are still accepted, but have been documented as deprecated and will be removed in a future release. Refer to manual sec…
Path segment validation is now more strict. The lifetime of a path segment needs to be fully covered by the validity period of the signing certificate chain. Previously, the certificate chain only needed to be valid at the time of verification.
Segments that are valid under this stricter regime have been created since v0.9.0, thus this stricter check is expected to be compatible with all ASes operating at least v0.9.0.
See #4286 for more details.
Simplify the configuration of the local address of a router interface. The fields public and bind have been combined into a single field local. The new field explicitly allows omitting the IP address, in which case the router binds to the wildcard IP.
The old public and bind fields are still accepted, but have been documented as deprecated and will be removed in a future release.
Refer to manual section on the topology.json file or #4489 for more details.
Added support for deleting segments and beacons.
Refer to the Open API section in the control service manual for more details (DELETE /segments/{segment-id}, DELETE /beacons/{segment-id}).
Update various dependencies; in particular, update quic-go to v0.43.1, go-toml to v2, security updates for lestrrat-go/jwx, x/crypto, and x/net.
In addition to the Debian packages built since the last release, we now also build packages for OpenWRT.
As the toolchain is relatively complicated, only x86_64 is supported for now. Like the .deb packages, these OpenWRT packages are not published in a package repository just yet. Packages for release versions are attached to the release. Packages for in-development versions are available from the latest nightly build.
See the installation manual page for more details.
Full Changelog: v0.10.0...v0.11.0
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Update various dependencies; in particular, update quic-go to v0.40.0. Update to go 1.21, building with go 1.21.3.
Update various dependencies; in particular, update quic-go to v0.40.0.
Update to go 1.21, building with go 1.21.3.
Build debian packages for the SCION services and tools for multiple target platforms (x86-64, arm64, x86-32 and arm).
These packages are not published in a package repository just yet. Packages for release versions are attached to the release. Packages for in-development versions are available from the latest nightly build.
See the installation manual page for more details.
Add benchmark tests for the router to track the packet forwarding performance.
These benchmarks are run in the CI, failing on unexpected performance regressions. The benchmark can also be run locally to determine the performance impact of any changes. For this, run e.g. bazel test --test_output=streamed -t- //acceptance/router_benchmark:test and inspect the measured performance in the test output.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Update google.golang.org/grpc dependency and set MaxConcurrentStreams, to address gRPC-Go HTTP/2 Rapid Reset vulnerability .
Full Changelog: v0.9.0...v0.9.1
Nothing published for this version
scion showpaths : the --json flag is deprecated in favor of the --format=json option.
Peering links in the topology are supported, in both the control plane (control) and the data plane (router).
Configuring a peering link requires setting the interface ID in the remote AS, see remote_interface_id in the configuration manual.
An internal restructuring of the router decouples receiving, processing and forwarding packets. Directly, this restructuring brings modest performance improvements, and enables a special, lower priority processing of any exceptional cases (SCMP traceroute requests, and SCMP error messages).
This will be the basis for more performance tuning in the future.
Receive and send buffer sizes, batch sizes as well as the number of packet processing goroutines can now be tuned. See router in the router configuration manual.
Dynamically-Recreatable Key (DRKey) is a system to establish shared symmetric keys between any two hosts in SCION, based on a key-derivation hierarchy that requires explicit key exchange only on the level of ASes. These keys are intended to be used primarily for packet authentication, in the form of the SCION Packet Authentication Option (SPAO) in the end-to-end packet extension header.
The control service now includes an implementation of the DRKey infrastructure. This system is still somewhat experimental and is disabled by default. See drkey in the control service configuration manual.
The AS-level key exchanges in DRKey rely on TLS for authentication, based on the SCION control-plane-PKI AS certificates.
As a side-effect of this, all other RPC invocations between control services now use the CP-PKI AS certificates, too. Previously, this had not been required, as all other RPCs control messages that were directly authenticated.
The router includes an experimental and somewhat incomplete implementation of SPAO-based authentication of SCMP messages. This, too, is disabled by default.
scion ping set payload size appropriately if --max-mtu is set (#4250) and and add new option --packet-size that allows setting the final packet size (#4251).scion ping scion traceroute and scion showpaths with the new format option (#4287).scion-pki certificate fingerprint --format emoji (#4252).scion-pki key fingerprint command to calculate SubjectKeyID (#4253).addr.HostAddr hierarchy with tagged union addr.Host.snet.SCIONAddress type, which is now only kept as a type alias for compatibility (#4346).By default, the SCION components now use a pure Go implementation of sqlite (modernc.org/sqlite) and build without CGo. This allows to build the SCION components as statically linked binaries, removing any dependence on a minimum libc or libresolv version.
All pull-requests now run through formal program verification using Gobra. Only a small fraction of the source code carries the annotations that enable the verification, but already some bugs in edge cases could be discovered and fixed.
router now validates that the source IP address of transit packets match the IP address of the corresponding other router (#4157). This could be incompatible with certain asymmetric NAT setups.trustengine.cache.expiration now expects a formatted duration string, instead of an integer number of nanoseconds.IntraASPathQuerier has been removed (moved to internal library) as it was not working correctly and not widely used.addr.HostAddr hierarchy with tagged union addr.Host (#4346).SetNetworkLayerForChecksum now only accepts a type-safe *slayers.SCION.MaxTTL is now a time.Duration instead of an int number of seconds.authoritative, voting, and issuing are ineffective and should no longer be used (#4333).scion showpaths: the --json flag is deprecated in favor of the --format=json option.Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →